linux-kernel - Re: [RFC PATCH] cmdline: Hide "debug" from /proc/cmdline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 4 Apr 2014 11:57:45 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	"Theodore Ts'o" <tytso@....edu>, Joerg Roedel <joro@...tes.org>,
	Jiri Kosina <jkosina@...e.cz>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Mateusz Guzik <mguzik@...hat.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	"H. Peter Anvin" <hpa@...or.com>, Borislav Petkov <bp@...en8.de>,
	Ingo Molnar <mingo@...nel.org>, Mel Gorman <mgorman@...e.de>,
	Kay Sievers <kay@...y.org>
Subject: Re: [RFC PATCH] cmdline: Hide "debug" from /proc/cmdline

On Fri, Apr 4, 2014 at 11:32 AM, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
> On Fri, Apr 4, 2014 at 11:21 AM, Andy Lutomirski <luto@...capital.net> wrote:
>>
>> The other thing I've used /dev/kmsg for is to shove a "I'm starting
>> something now" message in.  This is only really necessary because the
>> current kernel log timestamps are unusable crap.  (We could fix that,
>> hint hint.)
>
> I'd actually love to fix that, but I disagree with the "we could fix
> it". There are tons of people who know how to parse them (admittedly
> often only to ignore them), so changing the format is not likely to
> work.

What would break if we used CLOCK_BOOTTIME or CLOCK_MONOTONIC?  It's
currently sched_clock, which is measured in seconds but otherwise
seems to behave rather unpredictably.  We could keep exactly the same
format, but just use numbers measured in actual seconds instead of in
"seconds, but not really".

There are also log message metadata fields now; we could stick more
than one timestamp in there, and existing tools either won't see them
at all (if they use klogctl) or they already know how to ignore
unknown fields (/dev/kmsg).

For example, instead of logging:

[12345.67890] You wish you know what 12345 meant
  DEVICE=blah

we could log:

[12345.67890] Hah!  CLOCK_BOOTTIME says 12345.67890
  DEVICE=blah
  CLOCK_REALTIME=89173929281.171273

It would be really neat if we even went back and edited the queued up
messages once we have a clocksource.  Userspace isn't running yet, so
it can't be surprised.  We just won't show CLOCK_REALTIME at all until
someone sets the clock or we've read the RTC.  Interested users still
have CLOCK_BOOTTIME.

>
> The good news is that "dmesg -H" does help if you're human. While at
> the same time being an example of that very "there are tools that know
> about the current horrid format" issue.. D'oh.
>

I admit I have no idea wtf causes this lovely excerpt from dmesg -H:

[ +26.385160] systemd-readahead[629]: Failed to rename readahead file: Permissio
[Apr 3 20:50] TCP: lp registered

I assume it's because dmesg -H decides that it can't handle old
timestamps.  I don't know how it does with recent ones, though.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/